Wireless Network Security for IS Auditors
Explore wireless network security concepts, vulnerabilities, and audit procedures that CISA candidates need to evaluate Wi-Fi security in organizations.
Wireless Network Security Fundamentals
Wireless networks provide convenient connectivity but introduce unique security risks due to the broadcast nature of radio communications. For CISA candidates, understanding wireless security is important because wireless networks are common attack targets and require specific controls beyond those used for wired networks. Auditors must evaluate wireless configurations, authentication mechanisms, and monitoring practices.
The convenience of wireless connectivity must be balanced against the increased risk of eavesdropping, unauthorized access, and denial-of-service attacks. Organizations must implement appropriate controls to protect wireless communications and the networks they connect to.
Wireless Security Protocols
Evolution of Wi-Fi Security
Wireless security protocols have evolved significantly over time:
- WEP (Wired Equivalent Privacy): An outdated protocol with well-known vulnerabilities that can be exploited in minutes. Should never be used
- WPA (Wi-Fi Protected Access): An interim improvement over WEP using TKIP encryption. Also considered insecure by current standards
- WPA2: Uses AES-CCMP encryption and provides strong security when properly configured. Available in Personal (PSK) and Enterprise (802.1X) modes
- WPA3: The latest standard, offering improved key exchange (SAE), stronger encryption, and protection against offline dictionary attacks
Auditors should verify that organizations use WPA2 Enterprise or WPA3, and that older, insecure protocols are disabled.
Enterprise Authentication (802.1X)
WPA2/WPA3 Enterprise uses 802.1X authentication with a RADIUS server to provide individual user authentication rather than shared passwords. This approach enables unique credentials per user, centralized access control, integration with directory services, and detailed logging of wireless authentication events. Auditors should verify that enterprise authentication is used for corporate wireless networks and that RADIUS server configurations are properly secured.
Common Wireless Threats
Organizations face several wireless-specific threats that auditors should understand:
- Rogue access points: Unauthorized wireless devices connected to the corporate network, potentially bypassing security controls
- Evil twin attacks: Attackers creating fake access points that mimic legitimate networks to intercept user traffic
- War driving: Scanning for wireless networks from outside the facility to identify vulnerable targets
- Deauthentication attacks: Forcing users to disconnect and reconnect, potentially to a malicious access point
- Man-in-the-middle attacks: Intercepting wireless communications between users and access points
Wireless Security Controls
Effective wireless security requires multiple controls working together:
- Wireless intrusion detection/prevention systems (WIDS/WIPS): Detecting rogue access points and wireless attacks
- Network segmentation: Isolating wireless traffic from sensitive internal networks
- Guest network isolation: Providing separate networks for visitors that are completely isolated from corporate resources
- Access point hardening: Disabling unnecessary services, changing default credentials, and keeping firmware current
- Signal management: Adjusting transmit power to minimize signal leakage beyond facility boundaries
Audit Procedures
IS auditors evaluating wireless security should conduct wireless site surveys to identify rogue access points, review access point configurations for security compliance, verify that enterprise authentication is properly implemented, assess wireless monitoring and alerting capabilities, test network segmentation between wireless and wired networks, and review wireless access policies for completeness. Auditors should also verify that wireless security assessments are performed regularly and that findings are remediated promptly.